Skip to content

Commit 9fdd445

Browse files
robinkbrobinkb
committed
Support setting role path and permissions boundary for EKS control plane, EKS fargate profile, and managed machine pools
Signed-off-by: Robin Ketelbuters <[email protected]>
1 parent 07a93a5 commit 9fdd445

11 files changed

+183
-10
lines changed

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2913,6 +2913,30 @@ spec:
29132913
and no name is supplied then a role is created.
29142914
minLength: 2
29152915
type: string
2916+
rolePath:
2917+
description: |-
2918+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
2919+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
2920+
in the IAM User Guide.
2921+
2922+
This parameter is optional. If it is not included, it defaults to a slash
2923+
(/).
2924+
type: string
2925+
rolePermissionsBoundary:
2926+
description: |-
2927+
RolePermissionsBoundary sets the ARN of the managed policy that is used
2928+
to set the permissions boundary for the role.
2929+
2930+
A permissions boundary policy defines the maximum permissions that identity-based
2931+
policies can grant to an entity, but does not grant permissions. Permissions
2932+
boundaries do not define the maximum permissions that a resource-based policy
2933+
can grant to an entity. To learn more, see Permissions boundaries for IAM
2934+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
2935+
in the IAM User Guide.
2936+
2937+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
2938+
in the IAM User Guide.
2939+
type: string
29162940
secondaryCidrBlock:
29172941
description: |-
29182942
SecondaryCidrBlock is the additional CIDR range to use for pod IPs.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsfargateprofiles.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,30 @@ spec:
264264
and not delete it on deletion. If the EKSEnableIAM feature
265265
flag is true and no name is supplied then a role is created.
266266
type: string
267+
rolePath:
268+
description: |-
269+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
270+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
271+
in the IAM User Guide.
272+
273+
This parameter is optional. If it is not included, it defaults to a slash
274+
(/).
275+
type: string
276+
rolePermissionsBoundary:
277+
description: |-
278+
RolePermissionsBoundary sets the ARN of the managed policy that is used
279+
to set the permissions boundary for the role.
280+
281+
A permissions boundary policy defines the maximum permissions that identity-based
282+
policies can grant to an entity, but does not grant permissions. Permissions
283+
boundaries do not define the maximum permissions that a resource-based policy
284+
can grant to an entity. To learn more, see Permissions boundaries for IAM
285+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
286+
in the IAM User Guide.
287+
288+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
289+
in the IAM User Guide.
290+
type: string
267291
selectors:
268292
description: Selectors specify fargate pod selectors.
269293
items:

‎config/crd/bases/infrastructure.cluster.x-k8s.io_awsmanagedmachinepools.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -921,6 +921,30 @@ spec:
921921
and not delete it on deletion. If the EKSEnableIAM feature
922922
flag is true and no name is supplied then a role is created.
923923
type: string
924+
rolePath:
925+
description: |-
926+
RolePath sets the path to the role. For more information about paths, see IAM Identifiers
927+
(https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
928+
in the IAM User Guide.
929+
930+
This parameter is optional. If it is not included, it defaults to a slash
931+
(/).
932+
type: string
933+
rolePermissionsBoundary:
934+
description: |-
935+
RolePermissionsBoundary sets the ARN of the managed policy that is used
936+
to set the permissions boundary for the role.
937+
938+
A permissions boundary policy defines the maximum permissions that identity-based
939+
policies can grant to an entity, but does not grant permissions. Permissions
940+
boundaries do not define the maximum permissions that a resource-based policy
941+
can grant to an entity. To learn more, see Permissions boundaries for IAM
942+
entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
943+
in the IAM User Guide.
944+
945+
For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
946+
in the IAM User Guide.
947+
type: string
924948
scaling:
925949
description: Scaling specifies scaling for the ASG behind this pool
926950
properties:

‎controlplane/eks/api/v1beta1/zz_generated.conversion.go‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,28 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
8888
// +optional
8989
RoleAdditionalPolicies *[]string `json:"roleAdditionalPolicies,omitempty"`
9090

91+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
92+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
93+
// in the IAM User Guide.
94+
//
95+
// This parameter is optional. If it is not included, it defaults to a slash
96+
// (/).
97+
RolePath *string `json:"rolePath,omitempty"`
98+
99+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
100+
// to set the permissions boundary for the role.
101+
//
102+
// A permissions boundary policy defines the maximum permissions that identity-based
103+
// policies can grant to an entity, but does not grant permissions. Permissions
104+
// boundaries do not define the maximum permissions that a resource-based policy
105+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
106+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
107+
// in the IAM User Guide.
108+
//
109+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
110+
// in the IAM User Guide.
111+
RolePermissionsBoundary *string `json:"rolePermissionsBoundary,omitempty"`
112+
91113
// Logging specifies which EKS Cluster logs should be enabled. Entries for
92114
// each of the enabled logs will be sent to CloudWatch
93115
// +optional

‎controlplane/eks/api/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎exp/api/v1beta1/zz_generated.conversion.go‎

Lines changed: 26 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎exp/api/v1beta2/awsfargateprofile_types.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,28 @@ type FargateProfileSpec struct {
6060
// +optional
6161
RoleName string `json:"roleName,omitempty"`
6262

63+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
64+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
65+
// in the IAM User Guide.
66+
//
67+
// This parameter is optional. If it is not included, it defaults to a slash
68+
// (/).
69+
RolePath string `json:"rolePath,omitempty"`
70+
71+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
72+
// to set the permissions boundary for the role.
73+
//
74+
// A permissions boundary policy defines the maximum permissions that identity-based
75+
// policies can grant to an entity, but does not grant permissions. Permissions
76+
// boundaries do not define the maximum permissions that a resource-based policy
77+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
78+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
79+
// in the IAM User Guide.
80+
//
81+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
82+
// in the IAM User Guide.
83+
RolePermissionsBoundary string `json:"rolePermissionsBoundary,omitempty"`
84+
6385
// Selectors specify fargate pod selectors.
6486
Selectors []FargateSelector `json:"selectors,omitempty"`
6587
}

‎exp/api/v1beta2/awsmanagedmachinepool_types.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,28 @@ type AWSManagedMachinePoolSpec struct {
100100
// +optional
101101
RoleName string `json:"roleName,omitempty"`
102102

103+
// RolePath sets the path to the role. For more information about paths, see IAM Identifiers
104+
// (https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html)
105+
// in the IAM User Guide.
106+
//
107+
// This parameter is optional. If it is not included, it defaults to a slash
108+
// (/).
109+
RolePath string `json:"rolePath,omitempty"`
110+
111+
// RolePermissionsBoundary sets the ARN of the managed policy that is used
112+
// to set the permissions boundary for the role.
113+
//
114+
// A permissions boundary policy defines the maximum permissions that identity-based
115+
// policies can grant to an entity, but does not grant permissions. Permissions
116+
// boundaries do not define the maximum permissions that a resource-based policy
117+
// can grant to an entity. To learn more, see Permissions boundaries for IAM
118+
// entities (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
119+
// in the IAM User Guide.
120+
//
121+
// For more information about policy types, see Policy types (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policy-types)
122+
// in the IAM User Guide.
123+
RolePermissionsBoundary string `json:"rolePermissionsBoundary,omitempty"`
124+
103125
// AMIVersion defines the desired AMI release version. If no version number
104126
// is supplied then the latest version for the Kubernetes version
105127
// will be used

‎pkg/cloud/services/eks/iam/iam.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,8 @@ func (s *IAMService) CreateRole(
190190
key string,
191191
trustRelationship *iamv1.PolicyDocument,
192192
additionalTags infrav1.Tags,
193+
path string,
194+
permissionsBoundary string,
193195
) (*iam.Role, error) {
194196
tags := RoleTags(key, additionalTags)
195197

@@ -202,6 +204,8 @@ func (s *IAMService) CreateRole(
202204
RoleName: aws.String(roleName),
203205
Tags: tags,
204206
AssumeRolePolicyDocument: aws.String(trustRelationshipJSON),
207+
Path: aws.String(path),
208+
PermissionsBoundary: aws.String(permissionsBoundary),
205209
}
206210

207211
out, err := s.IAMClient.CreateRole(input)

0 commit comments

Comments
 (0)